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FOREWORD 



In the study of explosives and their applications, safety is of 
paramount importance. This report describes a practical risk analysis 
system which was developed as an outgrowth of safety considerations 
for a continuing program of explosive blast effects. 

The study described in this report was performed during fiscal 
year 1976 and supported by Navy Director of Laboratory Programs Task 
Assignment R000 01 01. 

This report has been prepared primarily for timely presentation 
of information. Although care has been taken in the preparation of 
the technical material presented, conclusions drawn are not necessar- 
ily final and may be subject to revision. 
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SUMMARY 



Proper safety measures can make positive contributions toward in- 
creased production and reduced operating expense. Basic maxims for such 
programs can be summarized as (1) risk can never be completely eliminated, 
(2) care and effort can reduce risk, and (3) efforts to reduce risk should 
achieve maximum possible benefits. 

It is taken here that risk increases with the likelihood of some 
hazardous event, with exposure to that hazard, and with possible conse- 
quences of the event. Numerical scales for these three factors are de- 
veloped; an overall risk score is then given as the product of these 
three factors. This risk score can be correlated with experience and 
ranges from a situation where an operation should be discontinued through 
one where attention is needed, and down to one where the risk is consid- 
ered acceptable by our current social standards. 

Justification for a proposed risk reduction measure is taken as in- 
creasing with increasing risk score and with effectiveness of the pro- 
posed measure, and decreasing with increased costs. A justification 
factor so assigned varies from that for a highly worthwhile effort down 
to efforts of doubtful merit. Such assigned justification factors make 
it possible to establish realistic priorities within the safety program. 

The mathematical operations involved here are relatively simple and 
are performed either algebraically or graphically on nomographs. These 
nomographs permit direct entry through descriptive terms; they give both 
numerical and descriptive answers. Such answers are meaningful not only 
to safety personnel but also to management and operating personnel. The 
graphical method also provides written documentation for the analysis. 
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INTRODUCTION 



A successful accident prevention program, aside from its humanitar- 
ian aspects, makes positive contributions to production rates and to 
reduced operating expense. Much progress in such a program has been 
made in the last few decades. However, there is still room for improve- 
ment, which is well indicated by the observation that currently in the 
United States each year there are about 2,500,000 work-related disabling 
accidents with about 50,000,000 man-days of lost time and some 14,000 
fatalities, and that the cost of such accidents is about $14 ,000, 000, 000. 1 

A safety management program designed to reduce the toll from indus- 
trial accidents requires considerable thought, effort, and compromise, 
or it can prove to be both wasteful and ineffective. A mathematical 
approach that avoids these defects is presented here. 



SAFETY CONSIDERATIONS 



A safety program should be based on documented factual information 
and on informed judgement, and not on subjectivity or intuition. Like- 
wise, safety recommendations should be quantitative in nature so that 
alternative proposals can readily be evaluated, urgencies assessed, and 
safety priorities established. Furthermore, to be effective all safety 
terms should be expressed simply so that they are understandable by both 
operating and management personnel. 2 ’ 3 

Safety programs, desirable as they are, present difficulties. One 
concerns the level of effort that should be devoted to a safety program. 
A low level of effort may be inadequate and not achieve its purpose. 
Alternatively, the effort can be so intense that an entire operation is 
hampered to such an extent that no useful work can be accomplished. 



1 Accident Facts , published annually by the National Safety Council , 
425 N. Michigan Ave. , Chicago, 111. 

2 Rollin H. Simonds and John V. Grimaldi. Safety Management: 
Accident Cost and Control . Homewood, 111., Richard D. Irwin, Inc., 1963. 

3 H. W. Henri ch. Industrial Accident Prevention: A Scientific 
Approach. New York, McGraw-Hill, 1959. 
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From such considerations it follows that there is a best safety program 
for each situation. The following material describes one method for 
achieving this optimum. 



Hazard 



The word "hazard" implies a definite danger, particularly from some 
unanticipated and possibly fortuitous event that is beyond one’s immedi- 
ate control. Examples include such hazards as a passenger being killed 
in an automobile accident — there are some 50,000 such fatalities in the 
United States each year; being struck by lightning; and choking to death 
on a bite of steak. It is apparent that our ordinary daily activities 
expose us to many such hazards. Table 1 lists some of these using data 
from standard sources such as the National Safety Council 1 and World 
Almanacs. 



TABLE 1. Some Well-Known Hazards Encountered in Daily Activities. 

United States, 1975. 



Hazard 



Risk 



Riding in an automobile 

Working 

Flying 

Swimming 

Staying home 

Going to church 

Eating a steak 

Playing golf 

Nuclear power plant incidents 



56.000 fatalities 

14,200 fatalities; 2,500,000 
disabling accidents 
1,500 fatalities 
7,300 drownings 

6,800 fatalities from 2,700,000 
fires 

10 to 15 fatalities from 4,300 
fires 

3.000 choking to death 
150 killed by lightning 
None 



Risk 

The word "risk," or the equivalent phrase "amount of risk," indi- 
cates the chance that some particular hazard may actually cause injury 
or damage. Risk can be described in statistical-like terms. Thus the 
risk involved in riding in an automobile can be expressed by the obser- 
vation that in the United States there are some 45 driver-plus-passenger 
fatalities per 1,000,000,000 vehicle miles. The risk of being killed by 
lightning while playing golf can be described as about one fatality per 
10,000,000 golf games, and the risk of choking to death on a steak as 

about one fatality per 500,000,000 steaks, and so on. Table 2 shows 
some typical risks. 
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TABLE 2. Amounts of Risk Typically Considered Acceptable. 

United States, 1975. 



Hazard 



Risk 



Riding in an automobile.. 

Flying, scheduled flights 

Flying, all flights 

Working 

Riding a bicycle 

Hurricanes 

All accidents 

Nuclear reactor operation 



45 fatalities per 10 8 vehicle- 
miles; 1 fatality per 1,000 
rider-years 

1.3 fatalities per 10 8 pas- 
senger miles 

20 fatalities per 10 8 rider- 
miles 

1 fatality per 4,500 worker- 
years 

1 hospitalization per 10* 4 
rider-miles 

1 fatality per 2,500,000 per- 
son-years 

1 fatality per 1600 person- 
years 

1 "incident" per 3 x 10 8 
reactor-years 



The Acceptable Risk 



Since we cannot completely avoid all the hazards in our ordinary 
lives, all risk from such hazards can never be completely eliminated. 
However, one often takes steps to reduce the risk associated with some 
particular hazard. Thus when we drive carefully with seat belts fas- 
tened, we reduce the risk of becoming an automobile accident fatality. 
Similarly we avoid open stretches of a golf course when a thunderstorm 
is impending, and we eat our steaks in well-chewed small bites. 

The above lugubrious thoughts serve to introduce the concept of 
the acceptable risk, as suggested by Dr. Billings Brown of the Safety 
Division of the American Ordnance Association.* An acceptable risk can 
be defined as that real risk imposed by some hazard, but one that under 
the circumstances would not deter a knowledgeable and prudent person. 
Thus, the risks of riding in an automobile, playing golf, or eating a 
steak, are regarded by some people as acceptable risks. In any event 
such risks often seem preferred over never driving or riding in an 
automobile, never going out-of-doors, or never eating solid food. 



* Private communication, 1968. 
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Convenience plays a part in setting an acceptable level of risk. 
Thus the risk of being killed in an automobile accident is about one per 
1,000 rider-years and obviously is considered acceptable to many of us. 
This acceptance must be based in part on a rationalization such as, "I 
will never live for one thousand years, hence I will never be one of 
these fatalities . " 

Other circumstances play a part in determining what risk is accept- 
able. This can be illustrated by comparing data for riding in airplanes 
with those for riding in automobiles. The risk of traveling by airplane 
is far less than traveling by automobile, but there are some people who 
avoid airplane travel even though they ride in automobiles. And what is 
considered an acceptable level for risk in industrial work is well below 
that considered acceptable in either the airplane or automobile mode of 
travel. This low level of acceptable risk for industrial work merits 
approval; however, to achieve and maintain this level requires effort, 
along with optimum use of the available resources of time, material, and 
money . 



The Safety Maxims 



The basic thoughts behind the observations above can be formalized 
in safety maxims, as follows: 

1. All the many hazards in life cannot be completely avoided, and 
all risks from such hazards can never be completely eliminated. 

2. Careful thought and effort can often reduce the risks in ordin- 
ary life down to acceptable levels. 

3. Our limited resources of time and effort should be utilized 
for maximum benefits of risk reduction rather than being dissipated in 
hopeless efforts to completely eliminate certain selected risks. 

These safety maxims are well accepted in the technical community 
even though in some situations, legal ones for example, they may not be 
considered relevant. These safety maxims have led to a system as de- 
veloped here for quantitative characterization of risks and for evalu- 
ation of proposed risk-reduction procedures. This system uses numerical 
values for comparison purposes. It also provides descriptive terms that 
are meaningful, not only to safety personnel but also to those in man- 
agement and in operations. Such a system was first suggested in a re- 
port by William T. Fine, and many of the evaluations here are based on 
that report. 4 



4 Naval Ordnance Laboratory. Mathematical Evaluations for Con- 
trolling Hazards ^ by William T. Fine. White Oak, Md., NOL, 1971. 
(NOLTR 71-31, publication UNCLASSIFIED.) 
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RISK CALCULATION 



The risk imposed by some particular hazard can be taken as increas- 
ing (1) with the likelihood that the hazardous event will actually occur , 
(2) with exposure to that event, and (3) with possible consequences of 
that event. For risk calculations, numerical values are assigned to 
each of these three factors. Then an overall risk score is computed as 
the product of these three separate factors. The numerical values, al- 
though arbitrarily chosen, are self-consistent and together they provide 
a realistic but relative score for the overall risk. 



Likelihood of Hazardous Event 



The likelihood of occurrence of a hazardous event is related to 
the mathematical probability that it might actually occur. For purposes 
here, however, likelihood is expressed in alternative terms of expecta- 
tions. Likelihoods that may be encountered in practical safety situa- 
tions range from the completely unexpected and unanticipated, but re- 
motely possible, up to an event that might well be expected at some 
future time. 

An example of the first of these, an unexpected but remotely pos- 
sible event, is failure of a proof-tested container of compressed gases. 
For mathematical purposes the likelihood factor for such an event is 
arbitrarily assigned the value of unity. An example of the second type 
of hazardous event, one which might well be expected at some future 
time, is combustible material catching on fire in a drying oven, par- 
ticularly if this has happened in the recent past. The likelihood fac- 
tor for such an event is assigned the value of 10. 

These two likelihoods provide reference points on a scale of like- 
lihoods for ordinary hazardous events. Situations between these two 
reference likelihoods are then readily assigned intermediate values. 

For example, a "could happen" type of event is assigned a likelihood 
value such as six, and an event that would be unusual, but still quite 
possible, is assigned a value of three. 

Safety considerations must provide not only for all such possible 
situations, but also for ones that approach the impossible. The abso- 
lutely impossible event would be assigned a likelihood value of zero. 
However, no event that can be described can ever be considered as being 
absolutely impossible; that is, have a mathematical probability of zero. 
Nevertheless, its probability can approach zero so closely that the 
event is virtually impossible. A likelihood value of one-tenth is 
assigned to this virtually impossible situation, which thus becomes 
another reference point for the likelihood scale. 



7 



NWC TP 5865 



This two-decade scale for likelihood factors ranges from the value 
of one-tenth for the virtually impossible event, through the value of 
unity for an unexpected but remotely possible event, up to the value of 
10 for an expected event. These reference points plus interpolated 
values are as follows: 

Likelihood Value 



*Might well be expected 10 

Quite possible 6 

Unusual but possible 3 

*0nly remotely possible 1 

Conceivable but very unlikely 0.5 

Practically impossible 0.2 

^Virtually impossible 0.1 



The Exposure Factor 



The greater the exposure to a potentially dangerous situation the 
greater is the associated risk. To provide for this, the value of unity 
is assigned to the situation of a rather rare exposure, perhaps only a 
very few times per year. Then the value of 10 is assigned for continu- 
ous exposure. Interpolation between these two reference points provides 
for intermediate values, thus the value of three is assigned fora weekly 
exposure. Extrapolation is needed to provide for situations of a very 
rare exposure, and indeed the value of zero would be assigned for no ex- 
posure at all. 



Likelihood Value 



‘^Continuous 10 

Frequent (daily) 6 

Occasional (weekly) 3 

Unusual (monthly) 2 

*Rare (a few per year) 1 

Very rare (yearly) 0.5 



Factors for Possible Consequences 



Damage from a hazardous event can range all the way from minor 
damage that is barely noticeable up to the catastrophic. This very wide 
range is taken as extending over two decades in numerical values. Thus 
the reference value of unity is assigned for the noticeable situation 
and the value of 100 for the catastrophic. 



^Reference point. 
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The noticeable situation is taken as one that involves a material 
damage of perhaps $100, or an incident that would be classified as a 
minor first aid accident. The catastrophic situation is taken as one 
where there are many fatalities, or where there is a material loss of 
millions of dollars. Intermediate factors are readily assigned; for 
example, a disaster with a few fatalities or with material damage greater 
than about $1,000,000 would carry the value of 40. Also included are the 
very serious, the serious, and the important situations. Consequence 
factors and values for these situations are included below: 



Possible consequence Value 



^Catastrophe (many fatalities, or >$10 7 damage).... 100 

Disaster (few fatalities, or >$10 6 damage) 40 

Very serious (fatality, or >$10 5 damage) 15 

Serious (serious injury, or >$10^ damage) 7 

Important (disability, or >$10 3 damage) 3 

^Noticeable (minor first aid accident, or 

>$100 damage) 1 



It can be noted that the relation between possible material damage and 
the consequence factor can be represented by the empirical formula 

factor = (damage/100) 0 • 4 

Consequence factors have two rather different aspects. One is 
personnel injury or fatality, or both. The other is material damage. 

In spite of possible objections, practicalities of the situation dictate 
a common scale for these two quite different items (such as for liabil- 
ity insurance) . Such a common scale has an advantage in that it can 
provide for situations where both personal injury and material damage 
might occur; here the consequence factor is a weighted sum of its two 
diverse aspects. 



Risk Score 



The risk score for some potentially hazardous situation is given 
numerically as the product of three factors: one numerical value each 
for likelihood, for exposure, and for possible consequences. 

Numerical risk scores, as so computed, can readily be associated 
with the risks observed for actual situations. Thus experience indi- 
cates that a risk score as low as 20 represents a situation of low risk, 
one considered acceptable by our current standards for industrial work. 



^Reference point. 
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Such a risk is far less than the risks we ordinarily accept in everyday 
situations; for example, when we drive to work, when we mow the lawn 
with a power mower, or when we ride a bicycle for exercise. 

Experience also indicates that a situation with a risk score in the 
order of 70 to 200 is one with substantial risk where, according to our 
current social standards, correction is needed (the social standards of 
years ago were not so demanding). Then there can be higher risk situ- 
ations; a risk score of 200 to 400 indicates that correction is urgently 
needed. A very high risk score of more than 400 indicates a situation 
so risky that one should consider ceasing operation until at least in- 
terim measures to correct the deficiency can be implemented, or perhaps 
permanent shutdown becomes necessary if the operation cannot be made 
safe. These risk score classifications are based on experience and are 
subject to adjustment when experience indicates otherwise. However the 
classifications are very conservative and therefore provide strong state- 
ments for the risks involved. 



Risk score 



Risk situation 



>400 



200 to 400 
70 to 200 
20 to 70 
>20 



Very high risk; consider discontinuing 
operation 

High risk; immediate correction required 
Substantial risk; correction needed 
Possible risk; attention indicated 
Risk; perhaps acceptable 



Graphical Calculation of Risk Score 



Risk scores, defined above as products of three factors, can with 
some convenience be calculated graphically as shown in Figure 1. The 
likelihoods are listed on the first or left line of this nomograph. The 
scale is logarithmic in nature and is graduated so that distances along 
this line are proportional to the logarithms of the likelihood factors. 
However, only descriptive terms appear, and the actual numbers have been 
omitted. The value of zero corresponding to a hypothetical "absolutely 
impossible" situation cannot be shown along this line as the logarithm 
of zero is minus infinity. Exposure factors are listed on the second 
line in the nomograph. Factors for possible consequences appear along 
the fourth line. 

To calculate a risk score using this nomograph, locations corres- 
ponding to each factor involved are first established. Then a line is 
drawn from the point for the likelihood factor through that for the ex- 
posure factor and extended to the tie line at the center. (Location 
along this tie line corresponds to the product of these two factors, but 
the numbers have been omitted.) A second line is drawn from this point 
on the tie line through that for the consequence factor and extended to 
the scale for the risk score. A numerical value for this risk score and 
its descriptive equivalent are then obtained directly. 
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FIGURE 1. Risk Analysis. 




NWC TP 5865 



Evaluation of a Proposed Risk-Reduction Action 

The larger the risk score for a situation, the more effective a 
proposed corrective action, and the less that action costs, the greater 
is the justification. A quantitative index for this justification can 
be derived from numerical values assigned to each of its three component 
factors. These are considered separately. 

Effectiveness Value 

The effectiveness value assigned to a proposed risk-reduction 
action is taken as unity for complete elimination of risk, and zero for 
an action with no effect. Intermediate values are assigned accordingly; 
for example, a measure that would reduce risk by about 60% would be as- 
signed an effectiveness value of 0.6. 



Cost and justification bear an inverse relation. Thus a cost fac- 
tor is best expressed as a divisor whose numerical value increases with 
cost so that increased cost gives lesser justification. 

Experience indicates that the divisor for cost is approximately 
proportional to the cube root of the total dollar amount included. 

These dollar amounts include actual out-of-pocket cost plus capitalized 
costs for any increase in operating or overhead expenses. On this basis 
the reference value of unity is assigned to the divisor representing a 
total cost of $100, and the value of 10 for costs of 1,000 times greater, 
or $100,000. The mathematical relation can be expressed in the form of 
an equation: 



Cost Effectiveness 



A justification factor for a proposed risk-reduction action can be 
obtained mathematically by multiplying the risk score for a given situ- 
ation by the effectiveness factor for the proposed action and then 
dividing by its cost divisor. This justification factor can be taken 
as the cost effectiveness for the proposed action. Numerical values 
for this cost effectiveness have been correlated with experience. Thus, 
a justification value of less than about 10 indicates that a proposal 
is of doubtful merit. The small risk reduction does not justify the 
indicated expenditure of time, effort, and money, and such endeavors 
could well be more effective in other situations. Values between 10 and 
20 indicate that action is justified. Experience suggests that a 



COST CONSIDERATIONS 




total cost 
100 
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justification value greater than about 20 indicates a highly worthwhile 
risk-reduction action. 

These values for the justification factor provide reference points 
for an entire scale of justification factors. This scale permits ready 
comparison of the merits of various proposals for reduction of identi- 
fied risk. The scale is also a great aid in establishing priorities 
within a broad risk-reduction program. 



Graphical Calculation for Cost Effectiveness 

The justification factor provides an index for cost effectiveness, 
and like the risk score can be calculated graphically as shown in Figure 
2. Entry to this nomograph is by three factors: one numerical value 
each for risk score as calculated previously, for degree of risk reduc- 
tion that the proposed measure provides, and for its cost divisor. 

Lines through these points give both a numerical value and a descriptive 
term for the justification factor. 

The graphical methods have several advantages over the algebraic. (1) 
When using the nomographs there is no need to refer to separate tables 
for values because entry can be made directly through the descriptive 
items of the chart. (2) The arithmetic calculation is simpler when done 
graphically and, although it is of limited precision, this is quite sat- 
isfactory for purposes here. (3) The graphical solution automatically 
provides documentation for both the risk analysis and justification cal- 
culation. 



ANALYSIS OF A HAZARDOUS SITUATION 



Risk Score Calculation 



An access road in a processing plant carries occasional traffic 
passing a large tank containing propane. There is a possibility that a 
loaded truck on this access road might accidentally swerve from the road 
at a point near the tank and crash into it. If so, the tank might fail 
and spill its highly flammable contents. Then if these contents caught 
on fire, the damage could be substantial. Loss of the tank and its con- 
tents and damage inflicted on neighboring parts of the plant could cost 
as much as $250,000. What is the risk score for this situation? 

Algebraic Solution . 

1. The chain of incidents described is conceivable but quite un- 
likely. The likelihood factor is assigned a value of 0.5 

2. Only occasional exposure (weekly) is involved. This factor 

is assigned a value of 3 
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3. As for possible consequences, serious personal injuries would 
not be expected. For material damage of about $250,000, a consequence 



factor is assigned (by interpolation) a value of 25 

4. Risk score: 0.5 x 3 x 25 = (rounded) 30 



This risk score of about 30 lies within the range of possible risk, 
and some attention is indicated. 

Graphical Solution . The above calculation can readily be performed 
graphically using Figure 1. First of the entry points are for desig- 
nated likelihood and exposure. A line through these is extended to the 
tie line and then drawn through the point for possible consequences onto 
the line for risk score. The risk score indicated here lies at about 30 
and is described as a possible risk, and some attention is indicated. 
This agrees with the algebraic results. 



Justification Factor Calculation 



It is suggested that the tank of the above risk score calculation 
be moved to a more remote location, one about 100 feet (30 meters) from 
the access road. This move would eliminate perhaps as much as 75% of 
the risk associated with the postulated accident. It is estimated that 
the move with its necessary replumbing would cost about $30,000. What 
is the justification factor and the cost effectiveness for this proposed 
safety action? 

Algebraic Solution . 



1. Risk score as computed above 30 

2. Value for 75% risk reduction 0.75 

3. Divisor for costs, cube root of (30,000/100) 6.7 

4. Justification factor and cost effectiveness 

30 x 0.75 v 6.7 3.3 



A cost effectiveness of only 3.3 indicates that the suggestion is of 
doubtful merit. But since the risk score of 30 indicates that some 
possible risk is present, it appears that alternative methods for risk 
control should be investigated. 

It is suggested that a sturdy guard rail properly placed along the 
road could reduce the risk of damage here considerably, perhaps as much 
as 50%. Such a guard rail should cost only about $400. What is the 
justification factor and the cost effectiveness for this proposed safety 
action? 

Algebraic Solution . 



1. Risk factor as computed above 30 

2. Value for 50% risk reduction 0.5 
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3. Divisor for costs, cube root of (400/100) 1.6 

4. Justification factor and cost effectiveness: 

30 x 0.5 r 1.6 9.3 



A cost effectiveness of 9.3 indicates that the action suggested in 
this proposal is justified, but not overwhelmingly so. Nonetheless, it 
is to be preferred over the somewhat more effective but far more expen- 
sive action of moving the tank. But in view of such a moderate justifi- 
cation, perhaps alternative proposals should also be investigated. For 
example, would a well-enforced speed limit be a preferred action? Or 
should action with regard to this specific risk be deferred in favor of 
a more justified action for some other risk situation? 
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